US Seizes Chinese-Linked Hacking Platforms Used in Cyber-Espionage Campaign

WASHINGTON: The United States Department of Justice has disrupted a Chinese cyber-espionage operation by seizing domains associated with two hacking platforms that U.S. authorities say were used to target sensitive government agencies, critical infrastructure and private-sector organizations.

The Justice Department said the platforms, known as QScan and QTRouter, were used in a cyber campaign that targeted several U.S. government institutions, including the Justice Department, NASA, the Federal Reserve and the U.S. Senate. The operation was also linked to attempts against other government agencies and organizations in the United States and South Korea.

According to a U.S. court affidavit, the hacking campaign had been active since at least 2018. Investigators said the operators developed and deployed tools to identify vulnerabilities and gain unauthorized access to sensitive computer networks.

The affidavit identified the Department of Energy, the Department of Health and Human Services and the National Institutes of Health among the organizations targeted. The campaign also reportedly resulted in successful theft of data from defense contractors, financial institutions and universities in May 2024.

U.S. authorities said the platforms were operated by Nanjing Xinjiuwei Network Technology Company, a China-based firm whose clients allegedly included China’s Ministry of State Security and the People’s Liberation Army. The company did not immediately respond to a Reuters request for comment.

The U.S. affidavit also detailed unsuccessful attempts to penetrate NASA networks in 2019 and efforts in March 2026 to access systems belonging to the U.S. Senate and a U.S. hospital.

A joint advisory issued by the FBI, National Security Agency and U.S. Cyber Command’s Cyber National Mission Force outlined multiple hacking activities associated with the operation and warned of the broader threat posed by Chinese-linked cyber actors.

China’s Embassy in Washington said it was not familiar with the specific allegations but maintained that the Chinese government firmly opposes and combats cyberattacks in accordance with the law. It accused Washington of using cybersecurity concerns to discredit China and said Beijing opposed the use of national security as a pretext for restrictions on Chinese companies.

Cybersecurity specialists said the case illustrates the growing role of private Chinese technology companies and contractors in conducting sophisticated cyber operations allegedly on behalf of Chinese government agencies.

The latest action adds to a series of cyber incidents in recent years that U.S. officials and cybersecurity experts have attributed to Chinese-linked actors, further intensifying tensions between Washington and Beijing over cybersecurity, intelligence gathering and the protection of critical infrastructure.